2024 Evolve Bank partner breach
Data compromised
Customer data at Evolve; potential credential exposure
Technical writeup
Jun 2024. Stripe indirectly affected by Evolve Bank & Trust breach. LockBit ransomware stole data from Evolve (banking partner to Stripe, Affirm, Wise, etc.). Customer data from partnered services may have been compromised. Oct 2024: separate GitHub 'Pwn Request' vulnerability in Stripe repo allowed code execution.
Root cause
Third-party breach at Evolve Bank; LockBit ransomware.
References
- https://www.prnewswire.com/news-releases/privacy-alert-evolve-affirm-bilt-shopify-mercury-plaid-stripe-and-others-under-investigation-for-data-breach-of-millions-of-financial-records-302188411.html
- https://www.stepsecurity.io/blog/security-breach-in-stripe-repo-a-deep-dive-into-the-pwn-request-vulnerability